NarsCars Privacy Policy

Version of 24.10.2026

1. Who processes your data

The personal data controller is NARS CARS LLC (ТОВ «НАРС КАРС», brand NarsCars), EDRPOU code 40421306, address: 35 Simi Kulzhenkiv St., premises 3, office 2, Kyiv, 04202, Ukraine.

For any personal data question, write to [email protected].

This policy covers the narscars.com.ua website, bookings, calls, online chat, correspondence and rental agreements with NarsCars. By ticking the box when you book, you confirm that you have read this policy.

2. What data we collect

2.1. Booking and rental agreement:

• full name, phone number, e-mail;
• passport or ID card, including date of birth and registered address if the document shows them;
• driving licence;
• Ukrainian taxpayer number (IPN);
• for foreign citizens: national passport and driving licence with your name in Latin letters;
• booking data: city, dates, car, extras, amount, deposit, rental history.

You can send documents through the Diia app or electronically. We sign the agreement electronically through Diia and the e-document services Vchasno, Paperless, M.E.Doc and DocuSign.

2.2. Payment. You can pay by card online through monobank acquiring or at a PUMB payment terminal when you collect the car. We do not receive your full card details: the bank processes them. From the bank we receive the payment status and amount and the masked card number. If you pay by invoice, we see the payer's details in our bank statement.

2.3. During the rental:

• GPS tracker data from the car: location, route, speed, mileage and driving time. Our service and security staff have access to this data;
• handover reports, photos and videos of the car's condition, odometer and fuel readings;
• information on accidents, damage and traffic or parking fines related to the rental.

2.4. Calls. We use Binotel telephony and record calls with our managers, and we tell you about the recording at the start of the call. We keep the phone number, date, duration and call recording. The website runs Binotel call tracking, which shows each visitor a separate number and records which ad or page the call came from.

2.5. Online chat and correspondence: the name and contacts you give us and the content of your messages in Jedidesk chat, e-mail and messengers.

2.6. Newsletters: your e-mail and phone number if you agreed to receive news and offers.

2.7. Collected automatically on the website: IP address, cookies and similar identifiers, device and browser type, language, pages viewed, time of visit, referral source and ad campaign. Microsoft Clarity records how you use a page: clicks, scrolling, cursor movement.

2.8. Customer checks. Before handing over a car, we check the data you provided against open state registers and paid verification services to prevent fraud, theft and damage to the car.

2.9. Corporate clients. When a company rents a car, we process the data of its representatives and drivers that the company gives us. The company informs these people that their data has been shared.

3. Why we process data and on what basis

• Booking, concluding and performing the rental agreement, handing over and returning the car, payments, support during the rental. Basis: concluding and performing the agreement with you.
• Customer checks, protecting the car with GPS, fraud prevention, debt collection, defending our rights in court, call recording for quality control and as a record of what was agreed. Basis: our legitimate interest.
• Accounting and tax records, replies to requests from state authorities. Basis: a legal obligation.
• Website analytics, advertising and remarketing (Google, Meta, Microsoft Clarity). Basis: for visitors from the EU, the European Economic Area and the UK, your consent; for other visitors, our legitimate interest in measurement and advertising. You can opt out at any time in the banner or in Cookie settings.
• Newsletters. Basis: your consent, which you can withdraw at any time. Refusing ads and newsletters does not affect your booking.

At present, an employee decides whether to hand over a car. If we start making such decisions automatically, we will update this policy before that applies.

4. Cookies and services on the website

Service	Purpose	Provider
Google Tag Manager	managing website tags	Google
Google Analytics 4	visit statistics	Google
Google Ads and remarketing	advertising, including to people who have visited the site, and measuring results	Google
Meta Pixel	advertising on Facebook and Instagram and measuring results	Meta Platforms
Microsoft Clarity	analysing how visitors use the pages	Microsoft
Binotel	call tracking and callback requests	Binotel
Jedidesk	online chat	Jedidesk
Cloudflare	website speed and protection against attacks	Cloudflare

On your first visit you choose in the banner which cookies to allow. For visitors from the EU, the European Economic Area and the UK, advertising and analytics cookies are switched on only after consent. For other visitors they work straight away; to turn them off, click "Necessary only" in the banner or untick them in Settings. You can change your choice at any time via the "Cookie settings" link at the bottom of the page.

You can also block or delete cookies in your browser settings, turn off personalised Google ads at adssettings.google.com, install the Google Analytics opt-out add-on (tools.google.com/dlpage/gaoptout) and manage Meta ads in your account settings.

If you turn cookies off, parts of the website may not work properly.

5. Who we share data with

We do not sell your data. We share it only with those who need it:

• providers that process data on our behalf: Odoo CRM hosting, Binotel telephony, Jedidesk chat, e-mail and cloud services, analytics and advertising services (Google, Meta, Microsoft), Cloudflare, e-signature and e-document services (Diia, Vchasno, Paperless, M.E.Doc, DocuSign), the banks monobank and PUMB, the GPS monitoring provider Antenor, and customer verification services. They may use the data only to provide services to us;
• state authorities, courts and law enforcement, at their request, where the law provides for it;
• a lawyer we engage to protect our rights.

In an accident or other insured event, we share the necessary data with the insurance company to process the claim, and give a service station the customer's name and contact details when the customer comes in for repair or inspection.

6. Transfers outside Ukraine

Some services store data on servers outside Ukraine: Odoo CRM (a cloud provider), Google, Meta, Microsoft, Cloudflare and DocuSign, in the EU, the USA and other countries. We transfer data abroad when this is needed to perform our agreement with you, or for advertising and analytics on the bases described in section 3. In countries whose level of data protection Ukraine does not recognise as adequate, protection may be lower than in Ukraine.

7. How long we keep data

• Agreement, customer documents, handover reports, invoices: 3 years after the agreement ends and all payments are settled; accounting and tax documents for the periods set by law.
• Bookings that did not lead to an agreement: 1 year.
• Call recordings: 1 year.
• GPS tracker data: 1 year.
• Correspondence and chat: 1 year.
• Newsletter data: until you withdraw consent.
• Cookies: periods are set by the services; you can delete cookies in your browser.

If there is a dispute or debt, we keep the necessary data until it is finally resolved. When the period ends, we delete or anonymise the data.

8. Your rights

• to know what data of yours we process, where we got it, why, where it is stored and who receives it;
• to access your data and get an answer on whether we process it within 30 calendar days of your request;
• to have inaccurate data corrected and unlawfully processed data deleted;
• to object to processing and to withdraw consent. Withdrawal applies to the future and does not cover data needed for the agreement or required by law;
• to set limits on processing when you give consent;
• to know how automated processing works and to be protected from automated decisions with legal effects for you;
• to have your data protected from unlawful processing, loss or destruction;
• to complain to the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua) or to a court.

9. How to contact us

Write to [email protected] with the subject "Personal data". Give your full name, a contact for our reply and what you are asking for. To avoid giving your data to someone else, we may ask you to confirm your identity. Within 10 working days we will tell you whether we can fulfil the request, and we will reply within 30 calendar days of receiving it. This is free of charge.

You can unsubscribe from newsletters at any time via the link in the e-mail or by writing to [email protected].

10. How we protect data

Only employees who need data for their work have access to it, and they must keep it confidential, including after they leave. Access to the CRM and documents is through personal accounts only. We choose providers that commit to protecting data. If data is lost or disclosed, we will let you know.

11. Changes to this policy

We may change this policy. A new version applies from the day it is published on this page; the version date is shown at the top. We will announce significant changes, such as new purposes of processing or new types of data, on the website.

This is a translation of the Ukrainian version. If the texts differ, the Ukrainian version prevails.